try to avoid SQL injection